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IN THE CLAIMS: 

1. (CURRENTLY AMENDED) A method for graphically presenting characteristics of data 
traffic on a distributed computer network, comprising: 

monitoring traffic on said network; 

selecting a characteristic of said traffic for display; 

obtaining a plurality of values of said characteristic for selected time intervals within 

a larger time interval; and 

presenting said characteristic by playing a rapid succession of graphical images, each 
graphical image in a graphical format, said graphical format representing said network in re 



representing traffic flow between nodes , each graphical image graphically representing the 
value of said characteristic at a particular selected time interval within the larger time interval 
w]thj-afld displaying a property of at least one line of said lines, said property indicating a 
value of said characteristic. 

2-3. (CANCELLED) 

4. (ORIGINAL) The method as in claim 1, further comprising: 

using a width of said at least one line as said property. 

5. (ORIGINAL) The method as in claim 1, further comprising: 

using a color of said at least one line as said property. 




-said network repr e sented as nodes connected by lines, said lines 
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6. (ORIGINAL) The method as in claim 1, further comprising: 

using an arrow drawn on said at least one line as said property. 

7. (ORIGINAL) The method as in claim 1, further comprising: 

using a length of said at least one line as said property. 

8. (ORIGINAL) The method as in claim 1, further comprising: 

using a density of said at least one line as said property. 

9. (ORIGINAL) The method as in claim 1, further comprising: 

using a visual characteristic of said at least one line as said property. 

10. (ORIGINAL) The method as in claim 1, further comprising: 

displaying a filtering expression in a graphical user interface; 

selecting, from said graphical user interface, records from network information files 
to display said characteristic of said traffic. 

11. (ORIGINAL) The method as in claim 10, further comprising: 

calculating parameters that are associated with the records selected from network files 
and storing the parameters in a local file. 

12. (CANCELLED) 
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13. (ORIGINAL) The method as in claim 1, further comprising: 

using a filtering program to select records in network information files that meet se- 
lected filtering criteria. 



14. (CURRENTLY AMENDED) The method as in claim 13, further comprising: 

compiling the selected appropriate r ecords from network information files during the 
selected specified time intervals, each compiled record meeting at least one selected filtering 
criterion. 



15. (ORIGINAL) The method as in claim 14, further comprising: 

calculating data that represent the compiled records, and storing the data in a file. 



16. (CURRENTLY AMENDED) The method as in claim 1, further comprising: 

displaying a map of the network topology and overlaying the map with said succes- 
sion of graphical images moving imag e s that graphically portray th e stored data, th e moving 
images changing with tim e to r e flect chang e s in the underlying data . 

17. (CURRENTLY AMENDED) The method of claim 414, further comprising: 

including a time interval criterion which indicates how often to compile and package 
information from the network information files. 



18. (CURRENTLY AMENDED) The method of claim 1, further comprising: 
terval with a starting time and an ending time specified within a filtering criteria. 
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1 9. (CURRENTLY AMENDED) A data visualization apparatus for graphically presenting 
characteristics of data traffic on a distributed computer network, comprising: 

means for monitoring traffic on said network; 

means for selecting characteristics of said traffic for display; 

means for obtaining a plurality of values of said characteristics for selected time in- 
tervals within a larger time interval; and 

means for presenting said characteristics by playing a rapid succession of graphical 
images, each graphical image in a graphical format, said graphical format representing said 
network in respons e to said monitoring, said network repres e nted as nodes connected by 
lines, said lines representing traffic flow between nodes , each graphical image graphically 
representing the value of said characteristics at a particular time interval within the larger 
time interval with ; and means for displaying a property of at least one line of said lines, said 
property indicating a value of said characteristics. 

20-21. (CANCELLED) 

22. (ORIGINAL) The apparatus as in claim 19, further comprising: 

means for using a width of said at least one line as said property. 

23. (ORIGINAL) The apparatus as in claim 19, further comprising: 

means for a using a color of said at least one line as said property. 

24. (ORIGINAL) The apparatus as in claim 19, further comprising: 
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means for using an arrow drawn on said at least one line as said property. 

25. (ORIGINAL) The apparatus as in claim 19, further comprising: 

means for using a length of said at least one line as said property. 

26. (ORIGINAL) The apparatus as in claim 19, further comprising: 

means for using a density of said at least one line as said property. 

27. (ORIGINAL) The apparatus as in claim 19, further comprising: 

means for using a visual characteristic of said at least one line as said property. 

28. (CURRENTLY AMENDED) The apparatus as in claim 19, further comprising: 

means for displaying a filtering expression in a graphical user interface; 

means for selecting, from said graphical user interface, records from network infor- 
mation files to display said characteristics of said traffic. 

29. (ORIGINAL) The apparatus as in claim 28, further comprising: 

means for calculating parameters that are associated with the records selected from 
network files and storing the parameters in a local file. 

30. (CANCELLED) 

31. (ORIGINAL) The apparatus as in claim 19, further comprising: 
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means for using a filtering program to select records in network information files that 
meet selected filtering criteria. 

32. (CURRENTLY AMENDED) The apparatus as in claim 31, further comprising: 

means for compiling the appropriate selected records from network information files 
during specified the selected time intervals, each compiled record meeting at least one se- 
lected filtering criterion. 

33. (ORIGINAL) The apparatus as in claim 32, further comprising: 

means for calculating data that represent the compiled records, and storing the data in 

a file. 

34. (CURRENTLY AMENDED) The apparatus as in claim 19, further comprising: 

means for displaying a map of the network topology and overlaying the map with said 
succession of graphical images moving images that graphically portray the stored data, the 
moving images chang ing-with-tim e- t o- r efle et changes i n the und e rlying data . 

35. (CURRENTLY AMENDED) The apparatus as in claim-4932, further comprising: 

means for including a time interval criterion which indicates how often to compile 
and package information from the network information files. 



36. (CURRENTLY AMENDED) The apparatus as in claim 19, further comprising: 
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means for defining the larger time interval with displaying a network activity for a 
period of time within a starting time and an ending time specified within a filtering criteria. 

37. (CURRENTLY AMENDED) A data visualization apparatus for graphically presenting 
characteristics of data traffic on a distributed computer network, comprising: 

a computer to monitor traffic on said network; 

a graphical user interface to select a characteristic of said traffic for display; 

a reporting system executing on said computer to obtain a plurality of values of said 
characteristic for selected time intervals within a larger time interval; and 

a visualization system executing on said computer to present said characteristics by 

playing a rapid succession of graphical images, each graphical image in a graphical format. 

r e pr e s e nt e d as nodes connected by lines, said lines representing traffic flow between nodes* 
each graphical image graphically representing the value of said characteristic at a particular 
selected time interval within the larger time interval with ; and instructions in said computer 
to display a property of at least one line of said lines, said property indicating a value of said 
characteristics. 

38-39. (CANCELLED) 

40. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a width of said at least one line as said 
property. 

41. (ORIGINAL) The apparatus as in claim 37, further comprising: 
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instructions to execute in said computer to use a color of said at least one line as said 
property. 

42. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use an arrow drawn on said at least one 
line as said property. 

43. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a length of said at least one line as said 
property. 

44. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a density of said at least one line as 
said property. 

45. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a visual characteristic of said at least 
one line as said property. 

46. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to display a filtering expression in a graphical 
user interface; 

instructions to execute in said computer to select, from said graphical user interface, 
records from network information files to display said characteristic of said traffic. 
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47. (ORIGINAL) The apparatus as in claim 46, further comprising: 

instructions to execute in said computer to calculate parameters that are associated 
with the records selected from network files and storing the parameters in a local file. 

48. (CANCELLED) 

49. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a filtering program to select records in 
network information files that meet selected filtering criteria. 

50. (CURRENTLY AMENDED) The apparatus as in claim 49, further comprising: 

instructions to execute in said computer to compile the appropriate selected records 
from network information files during the selected specifi e d time intervals, each compiled 
record meeting at least one selected filtering criterion. 

51. (ORIGINAL) The apparatus as in claim 50, further comprising: 

instructions to execute in said computer to calculate data that represent the compiled 
records, and storing the data in a file. 

52. (CURRENTLY AMENDED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to display a map of the network topology and 
overlaying the map with said succession of graphical images moving images that graphically 
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portray the stored data, the moving images changing with time to reflect changes in the un- 
derlying data . 

53. (CURRENTLY AMENDED) The apparatus as in claim^7-_50, further comprising: 

instructions to execute in said computer to include a time interval criterion which in- 
dicates how often to compile and package information from the network information files. 

54. (CURRENTLY AMENDED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to display a network act i v it y for a p e riod of 
tim e within define the larger time interval with a starting time and an ending time specified 
within a filtering criteria. 

55-56 (CANCELLED) 
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